Protect administrator upload paths
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
Follow this guide to use the module uploader instead of writing arbitrary paths.
Where to goAdmin Area → Licence Applications → Case → Upload Document
Before you start
- Use the exact navigation above and confirm the intended invoice, case, client, property, document or environment.
- Verify module activation and the stated permission before attempting the action.
- Use a controlled test record for payments, emails, public/portal access, provider calls and deletion.
What this guide helps you do
Use the module uploader instead of writing arbitrary paths. These instructions follow the supplied module’s live hooks, menus, controllers, forms, model rules and downstream effects.
Follow these steps
- Go to the case or storage/audit area described.
- Verify the intended record and visibility.
- Perform only the authorised action.
- Check the register, portal and retained evidence after the action.
Fields and options
Traversal handlingDownload resolver strips ../ and ..\
Category/help-centre/category/licence-applications/
Topic/help-centre/topic/licence-applications-deletion-security/
Rules and limits
- The module applies the stated soft-delete, ownership, visibility or storage behaviour.
Check it worked
- Protect administrator upload paths completes through the supplied module flow.
- Reopen the source record or settings page and verify the stored value, status, payment, file, timeline entry or notification.
Security, privacy and operational checks
- Do not expose landlord, property, identity or authority documents beyond their intended audience.
- Do not delete storage files directly to simulate a module action.
Related guides
Was this guide useful?Your response is stored only in this browser.